Microsoft Office Metadata - What every attorney should know about the hidden information in their client’s documents
By: Jon Rowe.
Microsoft Word contains hidden information regarding a documents characteristics, when it was created, edited and which author modified the document. In addition to the visible text in a Microsoft Word document there is also information which isn't visible that track the document through creation and revision.
It is easy to understand that during a computer forensic exam or the discovery phase of a litigation metadata can play an important role. Metadata can assist with an evidence timeline and identify those who touched the evidence.
All Microsoft Office documents contain metadata and there are dozens of other file types which also store valuable information about the file. These topics will be covered in a different article.
The information in emails commonly referred to as ‘metadata’ which includes ‘To:’, ‘From:’, ‘CC’ etc. are actually database fields and aren’t hidden. The purpose of this article is to deal with the hidden information contained in files related to Microsoft Office documents.
In addtion to Microsoft office Word metadata there is file system metadata. File system metadata is stored outside of the Microsoft Word.
The date, time, size and other information displayed in Microsoft Windows is referred to the file system metadata and is store in the File Allocation Table (FAT).
File system metadata is relevant for a different reason. Spoliation often refers to the improper collection of electronic files when the file system metadata is altered during collection.
When computer files are copied from the custodian computer to another location during a document production file system metadata can be altered. Pinpoint Labs has created the software ‘SafeCopy’ so files can be copied between locations without altering metadata.
What data is contained in Microsoft Word metadata fields? Here is a list of the commond metadata fields:
MICROSOFT WORD METADATA FIELDS- File Name, Title, Author, Comments, App Name, Version Date, Created Date, Last Printed, Date Last Saved, Total Edit Time, Template, Shared, Subject, Category, Company, Keywords, Manager, Last Saved By, Word Count,Routing SlipTrack Changes, Fast Saves, Hidden text, Graphics Hyperlinks, Document Variables, Include Fields, Page Count, Paragraph Count, Line Count, Character Count, Chars, Byte Count, Presentation Format, Slide CountNote Count, Hidden Slides, Multimedia Clips, Last 10 Authors.
MetaViewer from Pinpoint Labs is a program that allows users to easily view the file system metadata and Microsoft Office metadata. MetaViewer also calculates and displays hash values for MD5, SHA-1 (SHA1) and SHA-256 (SHA256). Computer forensic examiners and litigation support professionals have found MetaViewer and valuable tool. MetaViewer can be downloaded from the Pinpoint Labs website.
Article Source: http://www.ezarticles.info
|
